Preserve header sensitivity across colliding path shapes

internal/engine/secret_classification_test.go

@@ -169,3 +169,34 @@ func TestSourceVersionEvidenceSensitivityUsesOriginalMountedPaths(t *testing.T)
 		t.Fatalf("unclassified or semantic evidence candidates = %#v; original path seen %v, ancestor predicate seen %v", classified, sawOriginalSequencePath, sawAncestorPredicate)
 	}
 }
+
+func TestSourceVersionEvidenceClassificationKeepsCollidingShapes(t *testing.T) {
+	t.Parallel()
+	type header struct {
+		Version string `yaml:"version" configkit:"secret"`
+	}
+	type configuration struct {
+		Meta map[string]header `yaml:"meta"`
+	}
+	schema, issue := buildSchema(reflect.TypeFor[configuration](), testSecretBinding())
+	if issue != nil {
+		t.Fatal(issue)
+	}
+	keyPath := Keys("meta", "0", "version")
+	indexPath := Keys("meta").Index(0).Key("version")
+	for _, reverse := range []bool{false, true} {
+		evidence := []*sourceVersionEvidence{{resolvedPath: keyPath}, {resolvedPath: indexPath}}
+		if reverse {
+			evidence[0], evidence[1] = evidence[1], evidence[0]
+		}
+		var sawKey, sawIndex bool
+		classified := classifySecretPathsWithEvidence(schema, func(path Path) bool {
+			sawKey = sawKey || reflect.DeepEqual(path, keyPath)
+			sawIndex = sawIndex || reflect.DeepEqual(path, indexPath)
+			return false
+		}, Metadata{}, nil, nil, evidence)
+		if !classified[keyPath.String()] || !sawKey || !sawIndex {
+			t.Errorf("reverse=%v: classified=%v, key seen=%v, index seen=%v", reverse, classified, sawKey, sawIndex)
+		}
+	}
+}